> ## Documentation Index > Fetch the complete documentation index at: https://sandboxfinancialtechnologiesprivatelimited.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Authenticate a TRACES deductor > Authenticate a deductor with a TAN and TRACES password to obtain a deductor access token and refresh token. This endpoint uses your Sandbox access token in the `Authorization` header. See the [Quickstart guide](https://sandboxfinancialtechnologiesprivatelimited.mintlify.site/guides/get-started/quickstart.md) for Sandbox authentication. Save the returned `data.access_token` and `data.refresh_token`. Use `data.access_token` in the `Authorization` header for requests that require a deductor access token. When the deductor access token expires, use [Refresh a TRACES deductor session](https://sandboxfinancialtechnologiesprivatelimited.mintlify.site/api-reference/tds/compliance/traces/endpoints/refresh.md). ## OpenAPI ````yaml api-reference/tds/compliance/openapi.json POST /tds/traces/deductors/authenticate openapi: 3.1.0 info: title: compliance description: >- Tax Deducted at Source (TDS) is an indirect method of collecting Income Tax. TDS is based on the principle of “Pay as you earn” which is beneficial for both the Government and the taxpayer. It is where a person making a payment of specified nature is liable to deduct tax at a prescribed rate. This ensures continuous revenue for the Government by way of Tax Deducted at the Source. The Payer making a payment is also responsible to deposit TDS with the Income Tax Department within a specified date and file a TDS Return. Once filed, the deposited amount will be shown in the Payee's Form 26AS which they can then use to claim tax credits when filing ITR. However, staying TDS compliant can be a hassle for businesses, as they are required to : 1. Deduct TDS from payments that are liable for TDS Deduction at an appropriate rate. 2. Deposit TDS to Government before the due date. 3. File TDS Returns on a Quarterly basis. 4. Issue a TDS Certificate by the deductor to the deductee. Organizations deducting TDS have to remain compliant with each of the steps. Failure to do so results in TDS Penalties by Authorities. Sandbox provides TDS Compliance APIs to help you automate end-to-end TDS compliance. version: 1.0.0 servers: - url: https://test-api.sandbox.co.in description: test - url: https://api.sandbox.co.in description: prod security: [] tags: - name: TDS Compliance Check - name: Download CSI - name: FVU Generation - name: TDS - name: TDS Certificate - name: TRACES Credentials - name: E-File TDS Return paths: /tds/traces/deductors/authenticate: post: tags: [] summary: Authenticate with TRACES description: >- Authenticate with a deductor TAN and TRACES password. Returns access and refresh tokens for the TRACES session. Send your Sandbox API access token in the Authorization header. Example credentials and tokens are illustrative. operationId: authenticateTraces parameters: - name: Authorization in: header description: >- Sandbox access token. For token-generation steps, see the [Quickstart guide](https://developer.sandbox.co.in/guides/get-started/quickstart). required: true example: '{{access_token}}' schema: type: string - name: x-api-key in: header description: Sandbox API key. required: true example: '{{api_key}}' schema: type: string - name: Content-Type in: header description: Request body format. required: true example: application/json schema: type: string requestBody: required: true content: application/json: schema: type: object properties: '@entity': type: string enum: - in.co.sandbox.tds.compliance.traces.authentication.request tan: type: string pattern: ^[A-Z]{4}[0-9]{5}[A-Z]$ description: Deductor TAN registered with TRACES. password: type: string minLength: 1 writeOnly: true description: Password for the deductor TRACES account. required: - '@entity' - tan - password examples: Session created: summary: Session created description: >- A valid TAN and TRACES password return access and refresh tokens. Example credentials and tokens are illustrative. value: '@entity': in.co.sandbox.tds.compliance.traces.authentication.request tan: AHMA12345A password: your-traces-password Missing password: summary: Missing password description: >- The password field is missing. Include the password for the deductor TAN. value: '@entity': in.co.sandbox.tds.compliance.traces.authentication.request tan: AHMA12345A Incorrect TRACES credentials: summary: Incorrect TRACES credentials description: >- TRACES rejects the supplied credentials. Check the TAN and password before authenticating again. value: '@entity': in.co.sandbox.tds.compliance.traces.authentication.request tan: AHMA12345A password: incorrect-example-password Missing Sandbox authorization: summary: Missing Sandbox authorization description: >- The Authorization header is missing. Send the Sandbox access token in this header. value: '@entity': in.co.sandbox.tds.compliance.traces.authentication.request tan: AHMA12345A password: your-traces-password responses: '200': description: Returns access and refresh tokens for the TRACES session. content: application/json: schema: type: object properties: code: type: integer enum: - 200 timestamp: type: integer format: int64 description: Unix timestamp in milliseconds. transaction_id: type: string data: type: object properties: '@entity': type: string enum: - >- in.co.sandbox.tds.compliance.traces.authentication.response access_token: type: string description: >- Deductor access token for TRACES requests. Obtain a token with [Authenticate a TRACES deductor](https://developer.sandbox.co.in/api-reference/tds/compliance/traces/endpoints/authenticate). refresh_token: type: string description: >- Deductor refresh token used by [Refresh a TRACES deductor session](https://developer.sandbox.co.in/api-reference/tds/compliance/traces/endpoints/refresh) to renew the TRACES session. access_token_expiry: type: integer format: int64 description: Access token expiry as Unix time in milliseconds. refresh_token_expiry: type: integer format: int64 description: Refresh token expiry as Unix time in milliseconds. required: - '@entity' - access_token - refresh_token - access_token_expiry - refresh_token_expiry required: - code - timestamp - transaction_id - data examples: Session created: summary: Session created description: >- A valid TAN and TRACES password return access and refresh tokens. Example credentials and tokens are illustrative. value: code: 200 timestamp: 1792176139900 transaction_id: 198e8f90-691e-4c04-afaf-377611afa55f data: '@entity': >- in.co.sandbox.tds.compliance.traces.authentication.response access_token: >- eyJhbGciOiJSU0FTU0FfUFNTX1NIQV81MTIiLCJ0eXAiOiJKV1QiLCJraWQiOiJleGFtcGxlLXNpZ25pbmcta2V5In0.eyJpc3MiOiJhcGkuc2FuZGJveC5jby5pbiIsImF1ZCI6IkFQSSIsImludGVudCI6IkFDQ0VTU19UT0tFTiIsImlhdCI6MTc5MjE3NjEzOSwiZXhwIjoxNzkyMTc3MDQ3fQ.invalid-example-signature refresh_token: >- eyJhbGciOiJSU0FTU0FfUFNTX1NIQV81MTIiLCJ0eXAiOiJKV1QiLCJraWQiOiJleGFtcGxlLXNpZ25pbmcta2V5In0.eyJpc3MiOiJhcGkuc2FuZGJveC5jby5pbiIsImF1ZCI6IkFQSSIsImludGVudCI6IlJFRlJFU0hfVE9LRU4iLCJpYXQiOjE3OTIxNzYxMzksImV4cCI6MTc5MjE4MzM0N30.invalid-example-signature access_token_expiry: 1792177047000 refresh_token_expiry: 1792183347000 '400': description: >- The request body is invalid. Include a TAN and a non-empty TRACES password. content: application/json: schema: type: object properties: code: type: integer timestamp: type: integer format: int64 description: Unix timestamp in milliseconds. transaction_id: type: string message: type: string required: - code - timestamp - transaction_id - message examples: Missing password: summary: Missing password description: >- The password field is missing. Include the password for the deductor TAN. value: code: 400 timestamp: 1792176147907 transaction_id: 807b7940-d53e-4a19-8ead-718fcaa5868d message: Invalid request body '401': description: >- TRACES rejected the credentials, or the Sandbox Authorization header is missing. content: application/json: schema: type: object properties: code: type: integer timestamp: type: integer format: int64 description: Unix timestamp in milliseconds. transaction_id: type: string message: type: string required: - code - timestamp - transaction_id - message examples: Incorrect TRACES credentials: summary: Incorrect TRACES credentials description: >- TRACES rejects the supplied credentials. Check the TAN and password before authenticating again. value: code: 401 timestamp: 1792176148207 transaction_id: b7000183-316b-46b3-a7b9-494f9d16a995 message: Invalid credentials Missing Sandbox authorization: summary: Missing Sandbox authorization description: >- The Authorization header is missing. Send the Sandbox access token in this header. value: code: 401 timestamp: 1792176151923 transaction_id: e1dab6c2-d333-41a3-815b-932f869708e4 message: Unauthorized '403': description: The Sandbox API key or access token is invalid. content: application/json: schema: type: object properties: code: type: integer timestamp: type: integer format: int64 description: Unix timestamp in milliseconds. transaction_id: type: string message: type: string required: - code - timestamp - transaction_id - message '500': description: TRACES authentication could not be completed. Retry the request. content: application/json: schema: type: object properties: code: type: integer timestamp: type: integer format: int64 description: Unix timestamp in milliseconds. transaction_id: type: string message: type: string required: - code - timestamp - transaction_id - message deprecated: false security: [] ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.